Can smartphone apps track COVID-19 without violating your privacy?

Bluetooth and QR codes offer an alternative to using location data for contact tracing.
person leaning against his bike with his phone
Contact tracing apps could help prevent second and third waves of the coronavirus once social distancing rules loosen up across the country. Pexels

In California, early signs have begun to appear that the state’s swift and aggressive social distancing measures have slowed the spread of COVID-19. Now, the city of San Francisco is assembling a task force to prevent the disease from surging back once they relax stay-at-home orders. They plan to do so by tracking down everyone who has come into contact with those who test positive for COVID-19.

This technique, known as contact tracing, will be necessary across the United States to tamp down transmission levels until a vaccine comes along; a similar effort is already ramping up in Massachusetts. However, traditional contact tracing is time and labor-intensive, and will be difficult for public health officials to enact on the scale needed across the country. It also depends on people’s ability to remember everybody who they encountered over the preceding two weeks. But research groups across the U.S. are creating tech they hope will help.

“We’re looking at probably some sort of automated technology-based contact tracing, I think, if we want to be realistic,” says Tyler Yasaka, a software engineer and junior specialist in otolaryngology at the University of California, Irvine School of Medicine. He and his colleagues are among many teams of researchers around the world who have developed mobile apps to track the spread of COVID-19.

Multiple governments around the world have begun using location data from smartphones to monitor people’s movements, and this is not always done anonymously. In South Korea, developers have also offered several smartphone apps that plot the locations of people who have been diagnosed with COVID-19. But this approach invades people’s privacy and raises significant concerns about surveillance. That’s why Yasaka—as well as other groups led by MIT researchers and Apple and Google—are focusing their efforts on apps that don’t collect personal information or data on people’s locations. Instead, they anonymously link interactions between people.

The apps developed by Apple and Google and by the collaboration of researchers at MIT and other institutions rely on short-range Bluetooth signals, similarly to Apple’s “Find My” feature for locating lost devices. Each phone would automatically store a list of anonymous signals it has “overheard” from other nearby phones; when somebody is diagnosed with COVID-19, they could upload the list on their phone to a database. The apps would then alert the other users who recently came into contact with that person.

Yasaka’s app—called TrackCOVID and described earlier this month in the journal JMIR mHealth and uHealth—works a little differently. People would use their smartphone camera to scan a QR code (the square matrix barcodes seen on purchasable items in stores)—perhaps posted at the entrance to a grocery store or other public place—that would open a page on their web browser confirming that they have successfully checked in. The app would link them anonymously to other people who recently used the same checkpoint. A user could also choose to create a checkpoint when she meets with friends. In that scenario, her phone would generate a QR code that each of her friends could scan.“You use QR codes to basically keep up with all the places that a virus could be transmitted from one person to somebody else,” Yasaka says.

As with the other apps, people who test positive for COVID-19 can report their status anonymously and people linked to their chain of transmission would be notified that they may have been exposed to the virus. Yasaka and his team have already created a beta version of the app.

“As you move from one checkpoint to another those checkpoints do get connected together, but your identity is not involved in that and the app specifically never collects any information about you,” he says. “The whole process should take about five or ten seconds; you don’t have to download or register anything.”

However, one challenge for all of these apps will be ensuring enough people use them to create an accurate picture of COVID-19 transmission.

“I actually think there is value in having something that is an active and social process,” Yasaka says. When somebody scans a QR code, people around them will notice. “If other people are doing it, that might prompt you to also take part in it,” he says. Peer pressure also might help. If your friends are meeting up (once social distancing measures relax, that is) they can encourage you to do it with them, Yasaka says.

Another issue is making sure the self-reported data is accurate. If people don’t share their diagnoses or incorrectly report that they have COVID-19 that could make the app less effective. Coordinating with public health authorities could help prevent this from happening, Yasaka says. Authorized users who deliver test results to people could print out a QR code and ask folks if they would like to scan it to the app to notify others that they may be at risk. “That little prompt could help participation be higher,” Yasaka says.

He is currently discussing possible opportunities to collaborate with the team behind the MIT app, which is part of the university’s Private Automated Contact Tracing (PACT) project. Ideally, Yasaka would like TrackCOVID to be ready for widespread use by the end of summer. However, all of these apps will need to be evaluated by scientists and other experts before they can be broadly adopted, he adds.

Even then, they will not stall COVID-19 entirely. But reliable contact tracing and extensive testing are key for easing widespread lockdowns and intense social distancing without causing the disease to return in fresh waves that are as deadly as the initial outbreak. Apps such as the ones envisioned by Yasaka, the PACT team, and Apple and Google would complement old-fashioned contact tracing efforts, such as the ones underway in San Francisco and Massachusetts.

“Manual contact tracing is the premier, the gold standard for how this should be done,” said Ron Rivest, the principal investigator of MIT’s PACT project, in a public webinar the university hosted on April 16. “Automated contact tracing is not a replacement for that.”

He and his colleagues stressed that another crucial element for successfully deploying contact tracing apps is openness between groups working on different approaches.

“This is not an MIT effort, this is not a U.S. effort or a Massachusetts effort,” Rivest said. “This is a worldwide effort to get us all on the same side and work together to defeat the coronavirus. Collaboration is the key here.”